Hi Robin,

You find CSRF through POST with example at,

http://blog.runxc.com/post/2009/07/06/CSRF-by-Example-How-to-do-it-How-t
o-defend-it.aspx

--Amish

Robin Wood wrote:
> 2009/12/16 arvind doraiswamy <arvind.doraiswamy (at) gmail (dot) com [email concealed]>:
>
>> Hey Robin,
>> You shouldn't worry about GET or POST. A CSRF will happen in both
>> places. Its just that the GET is easier and more visible.
>>
>> For a POST you could either use OWASP's CSRF Tester to record and
>> replay a request. Or you could create a HTML page manually with all
>> hidden variables and just a button as a POC.
>>
>
> It is this bit I was after info on, I could think of a way that I
> would attempt a POST but wanted to see research others had done.
>
> As it turns out I've had quite a few good leads passed across, thanks
> to everyone. Most work in a similar way but all have slight variations
> that are useful to know about when trying to work out the best way to
> attack a target.
>
> Robin
>
>
>> Cheers
>> Arvind
>>
>> On Tue, Dec 15, 2009 at 6:27 AM, Robin Wood <dninja (at) gmail (dot) com [email concealed]> wrote:
>>
>>> Hi
>>> Can anyone point me at any good papers on doing CSRF through POST
>>> parameters? I've found some sites with redirect scripts which help
>>> performing the attack but no good write-ups on different ways to
>>> perform it.
>>>
>>> Robin
>>>
>>>
>>>
>>> This list is sponsored by Cenzic
>>> --------------------------------------
>>> Let Us Hack You. Before Hackers Do!
>>> It's Finally Here - The Cenzic Website HealthCheck. FREE.
>>> Request Yours Now!
>>> http://www.cenzic.com/2009HClaunch_Securityfocus
>>> --------------------------------------
>>>
>>>
>>>
>
>
>
> This list is sponsored by Cenzic
> --------------------------------------
> Let Us Hack You. Before Hackers Do!
> It's Finally Here - The Cenzic Website HealthCheck. FREE.
> Request Yours Now!
> http://www.cenzic.com/2009HClaunch_Securityfocus
> --------------------------------------
>
>
>

--
Amish Shah
Chief Technology Officer
Net Square Solutions Pvt. Ltd.
amish (at) net-square (dot) com [email concealed]
http://net-square.com/
+91 98257 09665

This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now!
http://www.cenzic.com/2009HClaunch_Securityfocus
--------------------------------------

[ reply ]